{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "a7fc4e3167420ca41e89f929a9721a63761e20c83b555338d91580d46e3dd3f1",
              "tlsh": "ff4142eb91952124a17371f4ca5f64082bbad16202439e98bc2ce385af7493c072adfc"
            },
            {
              "path": "postinstall.js",
              "sha256": "f96920db8aa0d72723e7eab7dc5319f4395a201f8eba307b4f81974730c1d75c",
              "tlsh": "571165e00191a6293222a1f1ca5f150917e9e4101201fe98f83cd285bff4e7c07f69ec"
            }
          ],
          "package_integrity": [
            {
              "filename": "alanced-match-1.0.0.tgz",
              "hashes": {
                "sha1": "ca2231abea3bb4cad9786e92ccc5a8002df72719",
                "sha512_sri": "sha512-g2qPbOPJmote+Y1VNxEYt28dxGPldP4MczXopsf4P4KnNOfLYHbl371tjPY0dkMnaC0VziO8mHcatiGPLTazgQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@prime0/alanced-match"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020072",
        "import_time": "2026-09-16T06:31:14.372842728Z",
        "modified_time": "2026-09-16T06:27:22Z",
        "sha256": "53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3)\nThe package @prime0/alanced-match is a 1-character-drop typosquat of balanced-match. Its postinstall.js runs automatically on npm install and POSTs a host fingerprint (hostname, username, platform, arch, cwd, node version, pid, non-internal IP addresses, uptime, package name) to the hardcoded bare-IP endpoint http://69.48.229.140:8080/b. Its main entry index.js opens a require-time HTTP polling channel to the same host, retrieves JSON commands from /c every 30 seconds (with 10-minute re-beacons), executes them via child_process.exec, and posts stdout/stderr back to /r \u2014 providing full remote code execution on the installer\u0027s machine. A source comment self-identifies the code as a \u0027Minimal stealth agent\u0027 and \u0027typosquat\u0027.\n",
  "id": "MAL-2026-16204",
  "modified": "2026-09-16T06:27:22Z",
  "published": "2026-09-16T06:27:22Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@prime0/alanced-match/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @prime0/alanced-match (npm)"
}